IT leaders confident in their ability to manage a ransomware attack: They should know better

ExtraHop released findings from a survey on ransomware that sheds light on the discrepancies between how IT decision makers (ITDMs) see their current security practices, and the reality of the ransomware attack landscape. The report shows that however capable IT organizations have been in managing the dramatic transformations of the past couple of years, confidence still tends to outstrip actual security posture.

The survey found that 77% of ITDMs are very or completely confident in their company’s ability to prevent or mitigate cybersecurity threats. Despite this confidence, 64% admit that half (or more) of their cybersecurity incidents are the result of their own outdated IT security postures, including widespread use of insecure and deprecated protocols, as well as growing numbers of unmanaged devices. This inflated confidence is even more dangerous in light of the frequency of ransomware attacks—as 85% reported having suffered at least one ransomware attack, and 74% reported experiencing multiple incidents in the past five years.

The impacts of ransomware and how ITDMs are dealing with it

• The cost of ransomware is high: 72% of respondents admitted to ever paying a ransom while 42% of companies that suffered a ransomware attack said they paid the ransom demanded most or all of the time.
• Damage to the business: Ransomware attacks affect the entire organization. 51% of respondents reported business downtime resulting from attacks on IT infrastructure, 44% reported business downtime resulting from attacks on OT infrastructure, such as medical devices, factory automation systems, and 46% reported end user downtime resulting from attacks targeting users.
• Everyone is looking for better insights, data, and cooperation: When asked to identify their top challenges, 43% cited the lack of cooperation between their network, security, and cloud operations teams. Additionally, 40% cited a lack of investment, 39% cited the long time required to train new hires, and 35% cited inadequate or overlapping tooling.
• WFH with outdated protocols: Despite the shift to working from home, 69% of respondents acknowledged transmitting sensitive data over unencrypted HTTP connections instead of more secure HTTPS connections. Another 68% are still running SMBv1, the protocol exploited in major attacks like WannaCry and NotPetya, leading to more than $1 billion in damages worldwide.
• Organizations are less than transparent: While 66% of respondents agreed it was good to disclose attacks, only 39% said they were fully open about attacks and willing to make information available for public knowledge when they actually took place.
• Slow response times to critical vulnerabilities: When it comes to responding to critical vulnerabilities by installing patches or shutting down a vulnerable solution, response times vary. Only 26% respond in less than a day—probably fast enough to prevent most attacks, while 39% take one to three days, 24% take up to a week, and 8% take up to a month.

“This research highlights the discrepancies between the reality of today’s sophisticated attack landscape and the overconfidence that many business leaders have in their ability to manage an attack,” said Jeff Costlow, CISO at ExtraHop. “Defenders need tools that can track attacker activity across cloud, on-premises, and remote environments so they can identify and stop an attack before they can compromise the business.”

This study shows that, even as companies continue to innovate with cloud technologies and remote workforces, their IT infrastructures remain mired in the past, with obsolete protocols providing ongoing opportunities for attackers to infiltrate networks and unleash ransomware attacks.

A lack of visibility and effective use of data has also contributed to organizations’ obstacles in identifying vulnerabilities and preventing ongoing ransomware attacks. To combat these challenges, organizations should look for ransomware mitigation tools that can capture network communications across all devices, and use technologies like behavioral analytics and artificial intelligence to detect behaviors that signal a ransomware attack in progress.

By leveraging a network detection and response platform, defenders can detect and stop the lateral movement and other post-compromise activity of ransomware attackers before they achieve real damage.